Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Oracle Helidon, specifically in the Imperative Web Server component, affects versions 4.0.0 through 4.5.0. It allows unauthenticated HTTP requests to read a subset of Helidon accessible data. The flaw is categorized as CWE‑284, Improper Access Control. An attacker with network access can exploit it to obtain confidential data without credentials. The CVSS 3.1 base score of 5.3 indicates a moderate impact focused on confidentiality with no effect on integrity or availability.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.5.0 are affected. No other versions or products are currently identified as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 places the vulnerability in the medium severity range. EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can exploit this from any network location with HTTP access to the Helidon service. No special privileges or additional conditions are required for exploitation.

Generated by OpenCVE AI on August 28, 2026 at 21:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Helidon to the latest patched version as released by Oracle and enforce that upgrade as soon as possible
  • Restrict external network access to the Helidon service, or place it behind a firewall or reverse proxy that requires authentication
  • Enable detailed audit logging on Helidon and regularly review logs for unauthorized access attempts

Generated by OpenCVE AI on August 28, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Helidon Imperative Web Server

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure via Oracle Helidon Imperative Web Server

Thu, 20 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Disclosure via Oracle Helidon Imperative Web Server

Wed, 19 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Allows Unauthorized Data Read in Oracle Helidon 4.5.1
Weaknesses CWE-200

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Allows Unauthorized Data Read in Oracle Helidon 4.5.1
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:31:00.982Z

Reserved: 2026-08-13T18:41:45.885Z

Link: CVE-2026-73900

cve-icon Vulnrichment

Updated: 2026-08-19T14:24:15.622Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:22.660

Modified: 2026-08-28T20:19:49.393

Link: CVE-2026-73900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:00:15Z

Weaknesses